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INTRODUCTION 

An  important  part  of  launch  operations  (vs.  test)  of  a 
new  large  military  or  space  vehicle  is  the  evaluation 
of  risk  to  test  range  personnel,  spectators  and  facili¬ 
ties.  Permission  to  launch  is  primarily  based  on  this 
evaluation,  which  is  required  for  every  system  to  be 
launched  and  may  takes  several  years  to  complete. 
Risk  is  usually  defined  as  the  product  of  the  prob¬ 
ability  of  a  failure  and  the  consequences  of  that  fail¬ 
ure  summed  over  all  credible  failures. 

TRW  developed  a  new  general  methodology  to  quan¬ 
titatively  assess  the  explosive  hazards  (i.e.,  risks)  of 
launch  of  systems  that  use  laigc  rocket  motors  con¬ 
taining  solid  propellant.  If  the  system  fails,  propel¬ 
lant  can  impact  the  ground,  release  explosive  energy 
and  produce  blast  waves  that  reach  people  or  vulner¬ 
able  facilities. 

The  method,  generally  applicable  to  all  large  mili¬ 
tary,  space  and  commercial  launch  vehicles,  was  de¬ 
veloped  during  the  evaluation  of  an  Eastern  Range 
launch  of  the  TITAN  IV  vehicle  that  uses  two  Solid 
Rocket  Motor  Upgrade  (SRMU)  boosters.  The  ef¬ 
fort  was  initiated  to  develop  an  alternate,  more  real¬ 
istic,  methodology  because  the  Air  Force  TITAN  IV 
SPO  (Systems  Program  Office)  was  concerned  that 
the  currently  used  methods  for  evaluating  range  safety 
could  be  unnecessarily  conservative  making  it  diffi¬ 
cult  to  achieve  launch  approval. 

The  methodology  developed  used  the  TITAN  IV 
Cassini  mission  as  a  basis  because  most  of  the  re¬ 
quired  information  was  readily  available.  Whenever 
possible,  failure  modes  and  effects  data  (discussed 
below)  were  taken  from  Lockheed-Martin  Aerospace 
(the  prime  contractor  for  TITAN  IV)  engineering 
sources.  In  a  few  instances  where  data  were  not  yet 
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available,  engineering  experience  and  judgement 
were  used  to  complete  the  data  base. 

Neither  the  Air  Force  nor  Lockheed-Martin  Aero¬ 
space  has  been  asked  to  validate  this  representation 
of  the  TITAN  IV  solid  rocket  motor  launch  hazards. 
The  method  developed,  using  the  stated  mission  ex¬ 
ample,  has  been  presented  to  the  Air  Force  TITAN 
IV  SPO,  Lockheed-Martin  Aerospace  personnel  and 
CCAS  (Cape  Canaveral  Air  Station)  and  VAFB 
(Vandenberg  Air  Force  Base)  range  personnel  and 
their  contractors.  TITAN  IV  with  SRMU  is  currently 
going  through  its  launch  approval  cycle  based  on 
currently  used  modeling  techniques.  TRW  believes 
that  the  presented  methodology  is  the  approach  of 
the  future  for  launch  hazards  safety  evaluations. 

SOLID  PROPELLANT  HAZARDS 

Solid  propellants  have  been  used  in  rocket  motors 
since  WW  II;  remember  JATO’s  (Jet  Assisted  Take 
Off).  Because  of  their  simplicity,  high  mass  fraction 
and  low  cost  compared  to  liquids,  solid  propellant 
rocket  motors  have  become  standard  boosters  for 
liftoff  of  large  military  and  commercial  space  sys¬ 
tems  (consider  TITAN,  the  Shuttle  and  Ariane).  Al¬ 
though  the  type  of  solid  propellant  used  in  these  ap¬ 
plications  (designated  Class  1.3  propellant)  has  tra¬ 
ditionally  been  considered  to  burn  or  deflagrate  only 
(as  it  does  in  a  rocket  motor)  we  now  know  that  it 
can  also  detonate  or  explode  when  impacting  surfaces 
at  high  speed,  and  that  this  event  will  produce  blast 
waves  in  the  surrounding  air  just  as  high  explosives 
do.  Thus  there  is  justifiable  concern  every  time  a 
system  with  large  solid  rocket  motors  is  launched  in 
that  a  failure  could  lead  to  the  explosion  of  a  signifi¬ 
cant  portion  of  the  solid  propellant  aboard.  For  TI¬ 
TAN  IV,  the  total  amount  of  propellant  is  approxi¬ 
mately  1,400,000  pounds  while  for  the  Shuttle  the 
total  is  about  2,200,000  pounds.  The  hazards  associ¬ 
ated  with  such  an  event  are  potentially  great  and 
warrant  an  investigation,  via  appropriate  methodol¬ 
ogy,  into  the  quantification  of  risk. 
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GOALS  OF  THE  METHODOLOGY 

The  overall  methodology  development  described  in 
this  paper  is  based  on  an  update  of  launch  hazards 
technology  previously  and  successfully  developed 
under  various  ballistic  missile  programs.  Much  of 
the  original  methodology  was  reviewed,  evaluated 
and  approved  by  a  committee  of  national  experts. 

As  indicated  above,  there  is  a  risk  at  any  vulnerable 
location  at  or  near  the  launch  site  that  a  system  fail¬ 
ure  could  cause  casualties  or  serious  damage.  For 
each  credible  failure  mode,  we  are  interested  in  the 
product  of  the  probability  of  that  failure  and  the  se¬ 
verity  of  the  event.  In  terms  of  the  risks  with  solid 
propellant  rocket  motors,  the  extent  of  the  explosive 
energy  release  on  ground  impact  measures  “sever¬ 
ity”  because  the  impact  will  generate  blast  waves  that 
can  travel  from  the  ground  impact  site  to  the  vulner¬ 
able  location.  It  is  the  blast  waves  that  cause  dam¬ 
age.  Since  these  kinds  of  data  have  been  compiled 
over  many  years,  using  TNT  as  a  “standard”  explo¬ 
sive  material,  we  can  relate  severity  directly  to  the 
amount  of  propellant  hitting  the  ground. 

The  “probability  of  the  failure”  is  measured  by  a 
series  of  probabilistic  and  deterministic  events  that 
precede  ground  impact  (discussed  under  Event  Trees 
below)  but  is  traced  back  to  the  original  failure  aboard 
the  vehicle  that  resulted  in  these  particular  events. 
The  probability  of  this  failure  is  usually  measured  by 
the  system  reliability,  specifications,  or  tests  avail¬ 
able  in  documents  such  as  the  FMEA  (Failure  Modes 
and  Effects  Analyses). 

The  overall  goals  of  the  methodology  can  be  stated 
as  follows: 

Choose  vulnerable  locations  (people/facilities) 

Determine  ground  impact  “footprints”  of  propel¬ 
lant  (how  much,  how  fast,  where,  and  when)  for 
each  failure  time,  for  each  failure  mode 

Determine  the  function,  probability  of  exceed¬ 
ing  blast  overpressure  vs  blast  overpressure,  at 
the  vulnerable  location  (the  result  is  in  the  form 
of  a  probability  distribution) 

Benefits  of  this  developed  methodology  include  the 
use  of  analytic  probabilistic  procedures.  Scientific/ 


engineering  calculations  are  used  whenever  possible 
to  explicitly  treat  the  physics  of  any  particular  event; 
probabilistic  calculations  are  used  only  when  this  is 
not  possible.  No  Monte  Carlo  techniques  are  em¬ 
ployed. 

The  results  can  be  used  directly  by  the  range  to  de¬ 
termine  risk.  If  low  enough,  either  due  to  low  prob¬ 
ability  or  low  severity,  launch  hazard  risk  may  be 
acceptable.  If  not  low  enough,  the  method  will  help 
identify  and  evaluate  mitigation  approaches. 

METHODOLOGY  ROADMAP 

The  methodology  consists  of  the  development  of  a 
database  of  salient  features  of  the  vehicle  to  be 
launched  and  of  the  launch  site,  the  determination  of 
the  relevant  set  of  failure  modes  that  can  lead  to  pro¬ 
pellant/ground  impact,  the  evaluation  of  the  specific 
spatial  trajectories  of  both  uncontrolled  (ballistic) 
propellant  (fragments,  rocket  motor  segments)  and 
controlled  propellant  (full  boosters  or  the  entire  ve¬ 
hicle)  to  determine  ground  impact  locations  and  im¬ 
pact  velocities,  the  determination  of  explosive  energy 
release  and  blast  overpressure  for  each  propellant  item 
based  on  a  TRW  developed  yield  correlation,  and 
(using  probability  “chains”  for  all  failure  modes  and 
times  of  failure)  appropriate  summation  of  all  the 
individual  probabilities  (for  all  propellant  items  im¬ 
pacting  the  ground)  to  give  the  desired  function,  the 
probability  of  exceeding  blast  overpressure  for  each 
vulnerable  location. 

Each  of  these  steps  is  described  below  in  detail.  The 
steps  can  be  matched  with  the  flow  diagram  in  Fig¬ 
ure  1 .  The  entire  process  is  a  classic  example  of  sys¬ 
tems  engineering  utilizing  the  skills  and  capabilities 
of  engineers  trained  in  various  technical  disciplines 
such  as  aerodynamics,  guidance  and  control,  rocket 
motors,  propellant  technology,  structures,  detonation 
physics  and  probability  and  statistics. 

Database 

Before  attempting  to  evaluate  the  relevant  potential 
failures  of  the  launch  process,  a  substantial  database 
regarding  both  the  system  to  be  launched  and  the 
launch  site  is  required. 


Figure  1.  Methodology  Roadmap  Flow  Diagram 


For  TITAN  IV  SRMU  (Figure  2),  interest  is  focused 
on  the  SRMU  booster  systems  since  that  is  where  the 
majority  of  solid  propellant  is  located.  For  the  par¬ 
ticular  mission  being  planned,  data  were  gathered  on 
the  structural  attachments,  the  three-segment  SRMU 
design  including  motor  performance  parameters,  the 
Guidance  and  Control  (G&C)  characteristics  includ¬ 


ing  nominal  trajectories  and,  very  importantly,  the 
automatic  destruct  systems  which  play  a  major  role 
in  determining  the  state  of  the  propellant  after  a  sys¬ 
tem  failure.  In  particular,  these  systems  are  designed 
to  “cut”  the  operating  rocket  motor  case  with  a  de¬ 
vice  called  a  linear  shaped-charge,  such  that  the 
graphite-epoxy  filament-wound  case  completely 


unravels.  Thus,  removing  external  restraint  on  the 
burning  propellant  grain  will  immediately  result  in 
fragmentation  and  radial  expulsion  of  the  remaining 
propellant;  this  process  defines  the  size  distribution 
of  the  propellant  under  these  circumstances.  The 
system  is  designed  such  that  this  will  occur  either  1) 
by  manual  command  by  Range  Safety,  2)  by  suffi¬ 
cient  inadvertent  physical  separation  of  the  SRMU 
from  the  central  (core)  vehicle,  or  3)  by  activation  of 
a  “thermal  barrier”  due  to  an  upper  stage  explosion. 
As  discussed  below,  when  these  destruct  systems  are 
not  activated,  the  propellant  is  generally  intact,  ei¬ 
ther  as  individual  segments  or  as  a  complete  SRMU. 
This  has  significant  implications  for  explosive  en¬ 
ergy  release. 

The  characteristics  of  the  launch  site  are  also  of  in¬ 
terest.  Vulnerable  locations  at  or  near  the  launch  pad 
were  identified  and  precisely  located  with  respect  to 
the  launch  pad  (see  Figure  3).  Terrain  in  the  vicinity 
was  identified  and  classified  as  either  water,  based 
on  the  Eastern  Test  Range  coastline  (which  was  ana¬ 
lytically  modeled),  sand  between  vulnerable  locations 
or  concrete  at  the  launch  pad.  The  characteristics  of 
these  surfaces  determine  the  extent  of  explosive  re¬ 
action  when  impacted  by  propellant. 

Another  important  feature  of  the  site  is  the  reaction 
time  of  Range  Safety  Launch  Operations  from  a  fail¬ 
ure  event  to  activation  of  the  manual  flight  termina¬ 
tion  system.  This  usually  consists  of  data  link  and 
processing  time  plus  reaction  and  decision  time. 
Since  it  is  known  that  large  propellant  pieces  are 
“worse”  than  smaller  propellant  pieces  and  that  flight 
termination  will  lead  to  the  above-mentioned  propel¬ 
lant  fragmentation,  short  reaction  times  are  clearly 
most  desirable.  Therefore,  to  make  the  analysis  trac¬ 
table  while  being  “conservative,”  a  reasonable  worst 
case  (i.e.,  largest)  reaction  time  was  determined  for 
two  cases:  7  seconds  for  quick  recognition  when  the 
failure  is  obvious  and  13  seconds  when  there  is  slow 
recognition. 

Failure  Modes 

The  determination  of  an  appropriate  list  of  failure 
modes  is  difficult  but  essential  to  the  fidelity  and  use¬ 
fulness  of  the  methodology  depicted  in  Figure  1 .  On 
the  one  hand,  it  is  critical  to  develop  a  comprehen- 


Figure  2.  Titan  IV  SRMU 


sive  enough  list  that  all  the  likely  cases  (that  lead  to 
significant  consequences)  are  considered  while  on  the 
other  hand  excluding  a  multiplicity  of  unlikely  or  non 
consequential  cases  that  will  make  the  analysis  in¬ 
tractable.  For  the  TITAN  IV  SRMU  study,  we  orga¬ 
nized  failures  in  terms  of  failure  groups:  rocket  mo¬ 
tor  failures,  G&C  failures  and  structural  failures. 
From  these  we  define  specific  “single  point  failure 
modes”  that  lead,  through  “event  trees,”  to  specific 
propellant  states  that  impact  the  ground. 

Failure  Groups  and  Modes 

Within  the  rocket  motor  failure  group,  the  failure 
modes  considered  were  non-ignition  of  one  of  the 


two  SRMUs  at  launch,  seal-leakage  between  seg¬ 
ments  as  in  the  Shuttle  Challenger  disaster,  rocket 
motor  case  failure  such  as  a  burn-through,  a  “blown” 
(loss  of  the)  throat,  loss  of  the  exit  cone  and  a  dam¬ 
aged  exit  cone. 

For  the  G&C  failure  group,  the  failure  modes  con¬ 
sidered  (all  but  one)  led  to  abnormal  motion  of  one 
or  both  of  the  TVAs  (Thrust  Vector  Actuators)  on  the 
SRMU  which  steer  the  entire  system  during  the  early 
part  of  flight  up  to  120  seconds.  The  failure  modes 
are  TVA(s)  hardover  as  far  as  they  can  go  (26  subcases 
since  there  are  two  TVAs  per  SRMU  and  two 
SRMUs),  TVAs  null,  one  TVA  constant  at  last  posi¬ 
tion  (4  subcases)  and  all  TVAs  constant  at  last  posi- 


Figure  3.  Vulnerable  Locations  At  Launch  Site  (LC41) 


tion.  The  final  G&C  failure  mode  is  inadvertent  early 
separation  of  the  SRMUs  which  are  supposed  to  sepa¬ 
rate  after  burnout. 

The  structural  failure  group  considered  two  failure 
modes,  collapse  of  the  core  vehicle  and  Centaur  fail¬ 
ure  which  includes  the  upper  stages  forward  of  the 
core  vehicle. 

Failure  Modes  are  summarized  in  Figure  4. 

Failure  modes  are  called  “single  point  failure  modes” 
and  are  specific  events  that  form  the  stalling  point  of 
an  event  tree.  They  are  identifiable  in  that  a  numeri¬ 
cal  probability  of  the  event  can  be  determined  either 
from  component/subsystem/system  reliability  data, 
from  customer  requirements  or  by  actual  test. 

These  data  are  sometimes  compiled  in  a  FMEA  (Fail¬ 
ure  Modes  and  Effects  Analysis)  document  for  the 
system.  Because  we  are  concerned  only  with  those 
failures  that  lead  to  propellant  impact  on  the  ground, 
the  “book”  values  of  the  probabilities  (or  reliability) 
must  be  modified  by  1)  the  proportion  of  all  failures 
of  the  type  under  consideration  that  will  lead  to  pro¬ 
pellant-ground  impact  and  2)  the  proportion  of  time 
over  which  the  analysis  is  concerned  (i.e.,  while 
ground  impact  is  still  possible)  compared  to  the  time 
over  which  the  reliability  is  specified.  These  two 
“correction”  factors  are  to  be  multiplied  by  the  quan¬ 
tity  (one  minus  reliability)  to  yield  the  probability  of 
the  failure  mode. 


Event  Trees 

For  each  single  point  failure  there  is  a  series  of  (per¬ 
haps  many)  following,  or  consequential,  events  that 
includes  1)  deterministic  paths  in  which  following 
events  are  known  or  can  be  analyzed,  2)  alternate 
paths  in  which  the  probability  values  are  fixed  by 
engineering  judgement,  3)  paths  in  which  a  series  of 
alternatives  is  known  to  be  equally  likely  (the  prob¬ 
ability  is  divided  among  the  number  of  paths),  and  4) 
alternative  paths  that  are  determined  by  a  6  DOF 
(Degree-of-Freedom)  simulation  analysis  which 
shows  that  these  alternate  event  probabilities  change 
with  time-of-failure.  Some  of  the  branch  points 
reached  after  the  single  point  failure  may  lead  to  con¬ 
sequential  failures  including  further  structural  fail¬ 
ure  of  the  vehicle. 

By  definition  for  this  study,  each  event  tree  results  in 
propellant  impacting  the  ground  or  water.  Therefore, 
in  every  case  the  end  of  the  branch  (last  box  on  the 
right)  is  the  state  of  the  propellant  on  impact.  Five 
states  are  recognized.  Propellant  impacts  either  as 
fragments,  intact  single  segments,  intact  attached  seg¬ 
ments,  intact  SRMUs  or  as  the  entire  vehicle  with 
two  SRMUs. 

Technically,  there  are  as  many  event  trees  as  single 
point  failures  (48  in  all).  For  convenience,  since  many 
are  similar,  the  study  grouped  them  into  13  failure 
modes.  Example  event  trees  arc  shown  in  Figures  5 
and  6. 


Group 

Mode 

Single  Point  Failure  Name  -  Description 

Rocket 

FM1 

Single  SRMU  fails  to  ignite  -  Tip  over  -  2  subcases 

FM2 

Seal  leakage  -  Segment  field  joint  -  2  subcases 

Motor 

FM3 

Case  failure  -  Burnthrough,  burst,  etc.  -  2  subcases 

FM4 

"Blown"  throat  -  Nozzle  throat  loss  -  2  subcases 

Failures 

FM5 

Exit  cone  loss  -  Nozzle  intact  -  2  subcases 

FM6 

Damaged  exit  cone  -  2  subcases 

FM7 

TVA(s)  hardover  -  26  subcases 

G&C 

FM8 

TVA(s)  null  -  2  subcases 

FM9 

One  TVA  constant  at  last  position  -  4  subcases 

Failures 

FM1 0 

All  TVAs  constant  at  last  position  -  2  subcases 

FM1 1 

Inadvertent  separation  -  SRMUs  separate  from  core 

Structural 

FM1 2 

Centaur  failure 

Failures 

FM1 3 

Core  collapse 

Figure  4.  Failure  Modes 


Figure  5.  Failure  Mode  1 :  Single  SRMU  Fails  To  Ignite 


1 -R4  =  9.67E-4  [SRMU  FMEA] 
F14  =  1.0 

F24  =  DT/TMAX4 

TMAX  =  140  SEC 


Figure  6.  Failure  Mode  4:  "Blown" Throat 


The  event  tree  specifies  the  probability  of  each  par¬ 
ticular  path  starting  from  the  single  point  failure, 
through  the  various  branch  probabilities,  to  the  final 
states. 

Also  the  event  trees  are  to  be  analyzed  in  detail  to 
determine  what  size  propellant  pieces  impact  the 
ground,  where  they  hit  and  how  fast.  This  is  seen  in 
the  middle  section  of  Figure  1 ,  which  refers  to  a  se¬ 
ries  of  “supporting  analyses”  that  are,  for  conve¬ 
nience,  divided  into  the  Tip-Over,  Intact  Vehicle  and 
Failed  Motor  Segment  cases.  Note  that  in  each  in¬ 
stance  a  trajectory  analysis  is  performed  of  the  solid 
propellant  to  the  ground  in  order  to  determine  its  fate 
at  impact. 

Trajectories 

The  Tip-Over  case  is  unique  in  that  it  is  derived  di¬ 
rectly  from  the  single  failure  mode;  one  SRMU  fails 
to  ignite.  The  system  barely  leaves  the  ground  but 
the  consequences  are  significant.  The  Intact  Vehicle 
case  occurs  when  both  SRMUs  impact  the  ground 
intact  (either  jointly  or  separately)  after  the  system 
has  become  airborne.  The  Failed  Motor  case  comes 
about  when  either  SRMU  case  fails  due  activation  of 
the  Flight  Termination  System  (FTS),  a  burnthrough, 
etc.,  and  fragmented  propellant  is  produced  (because 
of  the  internal  pressure)  along  with  intact  segments. 
These  are  illustrated  in  Figure  1 . 

Tip-Over  Case 

When  one  SRMU  fails  to  ignite,  it  can  be  shown  that 
the  “hot”  SRMU,  still  attached  core  vehicle,  will  ac¬ 
celerate  and  break  the  forward  attachments  to  the 
“cold”  SRMU,  leaving  it  unsupported  on  the  stand. 
The  cold  SRMU  will  tip  over  and  fall  to  the  ground 
landing  on  its  side.  An  analysis  of  this  event  shows 
that  all  segments  impact  at  essentially  the  same  time 
but  with  considerably  varying  impact  velocity;  ap¬ 
proximately  30  ft/sec  at  the  aft  segment  c.g.,  70  ft/ 
sec  at  the  center  segment  c.g.  and  100  ft/sec  at  the 
forward  segment  c.g. 

These  velocity  differences,  and  the  respective  weights 
of  the  individual  will  lead  to  different  explosive  yields 


for  each  segment  (see  Explosive  Yield  Correlation 
below).  Further,  the  computed  yield  for  each  seg¬ 
ment  is  statistically  distributed.  Because  the  segments 
are  effectively  independent  when  they  land,  the  yields 
generated  are  statistically  added,  using  a  procedure 
which  uses  a  convolution  integral,  to  get  the  correct 
distribution  of  yield  for  all  three  segments.  As  dis¬ 
cussed  below,  the  Tip-Over  case  results  in  a  signifi¬ 
cant  explosion  at  the  launch  site. 

The  hot  SRMU/core  combination  is  capable  of  fly¬ 
ing  a  short  distance  horizontally  but  does  not  have 
enough  thrust  to  lift  off.  It  will  also  impact  (con¬ 
crete)  in  the  launch  pad  vicinity  but  the  hot  SRMU 
will  be  cushioned  by  the  core  vehicle  which  lands 
first.  The  calculated  vertical  impact  velocities  rang¬ 
ing  from  80-120  ft/sec  depending  on  the  degree  of 
damage  to  the  exit  cone  in  the  separation  of  the  cold 
SRMU,  will  be  reduced  significantly  to  35-50  ft/sec. 
The  corresponding  yield  is  computed  as  for  the  cold 
SRMU. 

Intact  Vehicle  Cases 

Within  an  event  tree,  various  configurations  of  the 
vehicle  may  be  generated  depending  on  the  conse¬ 
quential  failures  that  might  occur  after  an  initial  single 
point  failure.  As  indicated  in  Figure  1,  one  possibil¬ 
ity  is  the  fully  intact  vehicle,  while  another  is  an  in¬ 
tact  SRMU  and  a  separate,  intact,  SRMU/core  ve¬ 
hicle  combination.  The  latter  configuration(s)  may 
occur  because  of  attach  point  failure  between  one  or 
both  SRMU(s)  and  the  core.  The  trajectory  for  each 
of  these  cases  can  be  followed  using  a  6  DOF  (De- 
gree-of-Freedom)  simulation  (computer  code)  with 
the  appropriate  aerodynamics,  guidance  information 
and  control  authority.  The  timing  of  configuration 
changes  (i.e.,  attachment  failures)  can  be  determined 
by  incorporating  a  structural  analysis  into  the  simu¬ 
lation.  Generally  speaking,  attach  point  failures  are 
precluded  only  by  ground  impact  or  by  range  safety 
FTS  operation.  The  relative  probabilities  of  these 
events  usually  depend  on  the  time  after  launch  when 
the  initial  single  point  failure,  occurs. 

Aerodynamics:  Examination  of  the  event  trees  in¬ 
dicates  that  four  vehicle  configurations  with  an  in- 


tact  SRMU*  can  occur:  the  original  fully  intact  ve¬ 
hicle  with  two  SRMUs,  a  core  vehicle/SRMU  com¬ 
bination,  and  the  same  two  configurations  with  the 
Centaur  (upper  stage)  removed  and  called  the  modi¬ 
fied  core/vehicle  and  the  modified  core/SRMU.  Each 
of  these  has  a  unique  set  of  aerodynamic  coefficients 
to  be  used  in  the  6  DOF  simulation.  The  basic  ve¬ 
hicle  data  were  taken  from  the  TITAN  IV  databook. 
For  the  other  configurations,  at  low  angles  of  attack, 
empirical  and  DATCOM  (a  standard  Air  Force  aero- 
prediction  code)  methods  were  used  to  determine  the 
coefficients.  At  high  angles  of  attack  (up  to  180°; 
some  of  the  vehicles  tumble)  the  low  angle-of-attack 
data  were  extrapolated  using  empirical  methods. 

Attach  Points:  SRMUs  are  attached  to  the  core  ve¬ 
hicle,  forward  at  a  shear  fitting  and  at  outriggers  and 
aft  at  “A”  points.  For  a  given  failure  scenario,  the 
system  is  subject  to  significant  acceleration,  angular 
rates  and  thrust;  aerodynamic  loads  and  angular  ac¬ 
celerations  were  shown  not  to  be  of  concern.  Result¬ 
ing  moments,  derived  from  statics,  were  evaluated 
to  determine  the  vertical,  lateral  and  horizontal  reac¬ 
tions  at  each  attach  point  and  shear  fitting.  Foad  com¬ 
ponents  were  summed  and  compared  to  attach  point 
capabilities  in  their  respective  directions.  A  Margin 
of  Safety  (MOS)  calculation  was  defined  for  each 
direction,  for  each  attach  point,  by  dividing  the  struc¬ 
tural  capability  by  the  applied  load  and  subtracting 
one.  This  was  introduced  into  the  6  DOF  code  and 
computed  at  each  time  increment;  the  first  MOS  that 
becomes  negative  defines  an  attach  point  failure 
leading  to  SRMU  separation. 

6  DOF:  The  6  DOF  simulation  is  a  computer  code 
with  subroutines  that  predict  vehicle  motion  and  ori¬ 
entation  for  all  of  the  above  described  configurations. 
The  simulation  uses  flight  control  equations  from  the 
TITAN  IV  prime  contractor  software  development 
group  and  includes  features  such  as  autopilot  execu¬ 
tive,  Stage  0  (SRMU)  mix  and  limit  function,  cant 
angle  logic,  segment  change  logic,  and  malfunction 
reset  logic.  The  code  inputs  are  the  nominal  trajec- 


*  A  separated  SRMU  alone  is  not  considered  since  a 
built-in  system  automatically  fires  the  FTS  in  that 
eventuality;  clearly  this  will  result  in  propellant  frag¬ 
ments  only,  as  discussed  above. 


tory,  mass  properties  and  aerodynamics  of  the  intact 
baseline  vehicle,  propulsion  thrust  vs  time,  guidance 
and  control  autopilot  functions,  aerodynamic  coeffi¬ 
cients  of  altered  configurations  as  described  above, 
the  MOS  subroutine  just  described  and  meteorologi¬ 
cal  data  vs  altitude.  The  code  output  predicts  vehicle 
motion  for  each  failure  mode  and  determines  impact 
time,  location,  velocity  and  orientation  including  to¬ 
tal  vector  velocity  and  vertical  velocity  (to  predict 
explosive  energy  output),  ground-track  coordinates, 
altitude,  body  angles,  inclination,  azimuth,  pitch  and 
yaw  rates  and  MOSs  for  all  attachments.  These  are 
the  data  necessary  to  determine  the  location  and 
magnitude  of  the  explosive  yield  if  the  vehicle  (two 
SRMUs)  or  a  single  SRMU  impacts  the  ground. 

As  indicated  above,  the  6  DOF  code  was  specifi¬ 
cally  used  to  determine  the  probabilities  associated 
with  multiple  paths  when  considering  attach  point 
failures.  Although  the  simulation  is  a  deterministic 
tool,  probability  paths  were  estimated  by  running  a 
single  failure  mode  with  various  events  allowed  or 
inhibited.  For  example,  the  attach  point  failures 
would  be  inhibited  to  obtain  a  particular  logic  path 
or  the  FTS  system  would  be  inhibited  and  the  ve¬ 
hicle  allowed  to  fly  to  impact.  From  the  relative  times 
of  these  possible  events,  the  relative  probabilities  of 
attach  point  failure,  FTS  and  ground  impact  were 
estimated  for  each  of  several  failure  times  for  the  ini¬ 
tiating  single  point  failure. 

Failed  Motor  Segment  Cases 

When  a  SRMU  case  fails  by  FTS,  burnthrough,  etc., 
the  graphite-epoxy  wrap  is  expected  to  unravel  very 
rapidly,  leaving  full  motor  pressure  within  the  burn¬ 
ing  core  and  no  restraining  force  on  the  unlit  outer 
periphery.  This  may  occur  for  all  three  segments  (for 
an  FTS)  or  for  only  one  of  the  segments  (in  a  burn- 
through).  As  seen  in  the  third  column  of  the  Sup¬ 
porting  Analyses  portion  of  Figure  1,  this  will  lead  to 
a  fragment  size  (weight)  distribution  and  a  velocity 
increment  radial  to  the  center  line  of  the  SRMU  which 
must  be  vectorially  added  to  the  vehicle  state-vector 
velocity  obtaining  at  the  time  of  the  breakup.  At  the 
same  time,  any  segments  not  involved  in  the  breakup 
will  be  released  intact  with  only  state- vector  veloci¬ 
ties  and  no  velocity  increment. 


Fragmentation  Model:  Contrary  to  our  expecta¬ 
tions,  very  little  data  exists  regarding  the  size  distri¬ 
bution  of  a  fragmented  rocket  motor  grain.  The  ma¬ 
jor  reason  is  that  most  propellants  will  burn  at  atmo¬ 
spheric  pressure  and  very  few  pieces  are  unignited 
or  inadvertently  quenched  in  the  failure  process. 
Although  many  flights  and  tests  are  documented  with 
photography  we  could  not  obtain  realistic  data  from 
such  sources.  Therefore,  it  was  concluded  that  a  plau¬ 
sible  theory  should  be  applied.  The  fragmentation 
model  utilized  for  this  study  is  based  on  an  empirical 
relation  developed  from  crushing  and  grinding  theory. 
Several  other  models  were  also  considered  (probabil¬ 
ity  theory  of  point/area/volume  defects  and  flaw  line 
and  energy  density  probability,  and  two-  and  three- 
dimensional  mechanical  breakup  theory  as  in  war¬ 
head  design).  But  these  were  considered  too  com¬ 
plex  to  justify  their  use.  The  chosen  model  is  the 
simplest  of  those  considered  and  is  consistent  with 
all  of  them.  It  is  a  theoretical  exponential  distribu¬ 
tion  and  states  that  the  number  of  fragments  greater 
than  a  given  size  divided  by  the  total  number  of  frag¬ 
ments  is  equal  to  e  (the  natural  logarithmic  base)  to 
the  negative  power  formed  by  the  fragment  size  di¬ 
vided  by  the  average  fragment  size.  Except  for  the 
average  fragment  size,  each  of  the  terms  in  this  ex¬ 
pression  can  be  related  to  total  propellant  weight  at 
any  given  failure  time.  Average  size  was  correlated 
with  web  thickness  using  (scant)  available  data  from 
ground  FTS  tests  of  Peacekeeper  Stage  III,  Small 
ICBM  Stage  I  and  C-4.  This  correlation  and  the  dis¬ 
tribution  function  then  allow  a  mathematical  deter¬ 
mination  of  the  statistical  weight  of  every  fragment. 
By  dividing  all  the  fragments  into  a  limited  number 
of  weight  bands,  the  average  weight  per  band  and 
the  number  of  fragments  in  that  band  can  be  deter¬ 
mined.  This  provides  a  complete,  statistically  rea¬ 
sonable  weight  distribution  of  fragments  for  any  fail¬ 
ure  time. 

Radial  Velocity  Increment:  As  with  fragment  size 
distribution,  there  is  virtually  no  database  for  the  ex¬ 
pulsion  velocity  of  propellant  on  failure  of  a  motor 
case  even  though  film  coverage  of  this  type  of  event 
is  plentiful.  Therefore  a  new  predictive  method, 
known  as  the  “incremental  force  balance  method,” 
was  developed  to  estimate  this  expulsion  velocity.  It 
assumes  rigid  annular-segment  shaped  fragments, 
adiabatic/insentropic  expansion  of  the  core  gas,  sonic 


(choked)  flow  between  fragments,  realistic  geomet¬ 
ric  pressure  distribution  on  fragments  and  no  axial 
flow  (which  means  that  all  fragments  are  expelled 
radially  only). 

The  method  is  based  on  conservation  of  gas  mass, 
the  continuity  equation,  isentropic  flow  relationships, 
the  core  gas  equation-of  state  and  Newton’s  laws  of 
motion.  It  accounts  for  pressure  reduction  on  frag¬ 
ments  due  to  the  growth  of  the  central  core  (gas  ex¬ 
pansion)  as  well  as  leakage  from  the  central  core  be¬ 
tween  fragments,  and  assumes  all  fragment  motion 
is  due  only  to  pressure  forces.  From  a  well-docu¬ 
mented  chamber  pressure  history  for  an  SRMU,  and 
the  applicable  set  of  iterative  equations,  a  unique  frag¬ 
ment  velocity  is  predicted  for  each  failure  time.  The 
method  assumes  that,  at  the  time  of  the  burst,  for  the 
bulk  of  the  propellant,  the  fragments  are  initially  simi¬ 
lar  in  size,  shape  and  weight  are  thus  all  expelled  at 
the  same  velocity.  Continued  fragment  breakup  is 
assumed  to  occur  after  this  initial  acceleration  be¬ 
cause  of  fragment  interaction  and  crack  propagation 
leading  to  the  above  fragment  size  distribution. 

Because  of  uncertainties  associated  with  fragment 
shape  and  surface  roughness,  non-uniformities  in  the 
grain  fragmentation  and  case  failure  processes,  and 
geometrical  variations  in  web  thickness,  a  +20%  vari¬ 
ability  in  computed  velocity  increment  was  assigned. 

3  DOF:  As  discussed  above,  and  indicated  in  Figure 
1 ,  both  fragments  and  possibly  intact  segments  can 
be  released  in  the  failed  motor  segment  case.  In  both 
instances,  the  subsequent  trajectory  to  the  ground  is 
calculated  with  a  3  DOF  simulation  which  computes 
ballistic  trajectories  for  unguided/uncontrolled/ 
unpropelled  objects  and  depends  only  on  gravitational 
and  aerodynamic  (drag)  forces  and  the  initial  veloc¬ 
ity  vectors. 

Fragments:  We  assume  that  the  fragments  are  non¬ 
burning  cubes,  tumbling  randomly.  The  nominal  drag 
is  obtained  from  the  literature  and  a  +20%  variabil¬ 
ity  in  the  coefficient  is  assumed.  At  the  time  of  fail¬ 
ure,  the  velocity  vector  of  each  fragment  (represented 
by  an  average  fragment  for  each  weight  band)  is  de¬ 
termined  by  adding  the  applicable  expulsion  veloc¬ 
ity  increment  (see  above)  to  the  vehicle  velocity  to 
vectorially  determine  the  new  fragment  velocity. 


Clearly  we  do  not  know  which  position  around  the 
circumference  of  the  failed  segment  a  given  fragment 
will  come  from.  We  therefore  assume  the  fragments 
are  equally  likely  to  come  from  any  position  and  ar¬ 
bitrarily  choose  eight  positions  at  45°  intervals  around 
the  circumference;  thus  each  interval  has  a  one-eighth 
probability  of  being  the  source  of  the  fragment.  By 
knowing  the  vehicle  body  orientation  (inclination  and 
azimuth)  from  the  6  DOF  simulation  at  the  failure 
time,  we  compute  all  eight.  3  DOF  trajectories.  Each 
gives  the  impact  time,  location  relative  to  the  launch 
site  and  ground  impact  velocity.  The  pattern  of  eight 
points  per  initial  condition  (failure  time  and  fragment 
weight)  gives  an  “impact  ellipse”  on  the  ground  with 
the  probability  that  the  fragment  will  impact  between 
any  two  adjacent  points  equal  to  one-eighth.  This 
can  be  viewed  as  “mapping”  the  fragments  from  the 
SRMU  segment  to  the  ground.  For  nominal  drag  and 
expulsion  velocity,  this  is  called  the  nominal  impact 
ellipse. 

The  process  is  repeated  for  the  same  fragment  with  a 
+20%  variation  in  expulsion  velocity  and  drag  thus 
defining  five  impact  ellipses  in  total.  A  portion  of 
each  ellipse  is  fit  with  a  second  order,  non-linear  equa¬ 
tion  that  is  used  to  determine  the  “center”  of  the  el¬ 
lipse,  the  angle  of  its  major  and  minor  axes  relative 
to  north  and  east  at  the  launch  site,  as  well  as  the 
magnitude  of  the  major  and  minor  axes. 

The  ground  is  divided  into  square  cells  the  size  of 
which  depend  on  the  perimeter  of  the  nominal  el¬ 
lipse.  The  combination  of  the  five  ellipses  then  de¬ 
termines  a  PDF  (Probability  Density  Function)  for 
the  probability  of  fragment  impact  on  the  cells. 

The  “thickness”  of  the  combined  ellipse  is  first  de¬ 
fined  by  measuring  distances  from  the  nominal  el¬ 
lipse  along  the  major  and  minor  axes  and  finding  the 
maximum  root-mean-square  of  the  averages  between 
the  drag  and  expulsion  velocity  cases.  A  rectangular 
“ellipse  area”  is  then  defined  by  seven  times  this  value 
from  the  nominal  ellipse,  in  the  major  and  minor  axis 
directions.  This  approach  assures  that  this  somewhat 
restricted  area  will  statistically  capture  Mi  impacts. 
In  any  given  instance,  we  need  only  computationally 
consider  those  cells  within  the  ellipse  area. 


As  a  check  on  the  procedure,  we  compute  the  prob¬ 
ability  of  impact  of  any  fragment  in  the  impact  el¬ 
lipse  area  and  it  should  be  equal  to  1.0.  We  then 
determine  the  maximum  range  consistent  with  the 
blast  overpressure  of  interest  (chosen  in  the  course 
of  the  computations)  for  the  largest  (average)  frag¬ 
ment  from  a  standard  set  of  tables.  Adding  this  range 
around  a  rectangular  area  enclosing  all  the  vulner¬ 
able  locations  defines  a  larger  area  called  the  “haz¬ 
ard”  area. 

This  complex  procedure  is  made  computationally 
efficient  by  considering  cells  only  in  the  “intersec¬ 
tion”  area  defined  by  the  overlap  of  the  hazard  area 
and  the  impact  ellipse  area.  Sequencing  cell-by-cell, 
the  shortest  distance  to  the  nominal  ellipse  and  the 
four  others  is  determined  and  the  local  “thickness” 
calculated  along  the  particular  normal  to  the  nomi¬ 
nal  ellipse;  from  this  the  number  of  “thicknesses” 
from  the  cell  to  the  nominal  ellipse  is  determined. 
Assuming  a  standard  normal  (Gaussian)  distribution 
normal  to  the  ellipse,  and  a  uniform  distribution  along 
the  ellipse,  the  probability  of  landing  in  the  cell  is 
computed.  Repeating  this  procedure  for  all  cells  in 
the  intersection  area  produces  a  map  of  the  distribu¬ 
tion  functions  for  the  impact  ellipse.  Figure  7  illus¬ 
trates  the  result  obtained.  The  peak  probabilities  are 
at  mid-point  of  the  thickness  and  decrease  “normally” 
both  away  from,  and  toward,  the  center  of  the  ellipse. 
The  boundaries  of  the  eight  sectors  chosen  above  can 
be  clearly  seen.  In  the  figure,  the  white  (A)  and  red 
(B)  areas  denote  high  probability  while  the  green  (C) 
and  purple  (D)  areas  indicate  low  probability.  It  is 
noted  that  the  peak  probability  is  not  constant  around 
the  perimeter  of  the  ellipse.  The  southeast  quadrant 
of  the  ellipse  exhibits  the  highest  probability. 

Generally  speaking,  the  cell  of  interest  will  not  be  at 
(or  even  near)  the  nominal  ellipse  for  which  frag¬ 
ment  impact  velocities  are  defined.  Although  frag¬ 
ment  weight  for  each  of  the  eight  points  on  the  nomi¬ 
nal  ellipse  is  the  same  (by  definition),  the  impact  ve¬ 
locity  varies  somewhat  over  the  ellipse  perimeter 
because  of  differences  in  trajectories.  The  recipro¬ 
cal  of  the  impact  velocity  at  the  cell  is  assumed  pro¬ 
portional  to  the  ratio  of  the  sum  of  the  square  of  the 
inverse  distances  from  the  cell  to  the  known  eight 
impact  points  divided  by  the  sum  of  the  respective 
known  eight  impact  velocities  divided  by  the  square 


Figure  7.  Sample  Impact  Elipse  (1/8th  Probability  Sectors  Marked) 


of  the  same  distances.  Thus  the  impact  velocity  for 
each  sized  fragment  at  each  cell  can  be  computed. 

This  new  method  effectively  accounts  for  all  frag¬ 
ments  from  a  segment,  or  from  an  entire  SRMU,  and 
provides  an  appropriate  statistical  description  of 
events  on  the  ground. 

Segments:  Whenever  fragments  are  produced  by  a 
failed  motor  segment,  there  may  also  be  intact  seg¬ 
ments  generated.  They  are  assumed  to  be  cylindri¬ 
cal,  tumbling  randomly  and  non-burning.  Because 
they  are  intact,  no  incremental  velocity  is  applied  to 
segments;  their  initial  velocity  vector,  with  small 
uncertainty,  is  the  state  vector  of  the  vehicle  at  the 
time  of  the  failure.  The  nominal  drag,  with  small 
uncertainty,  is  determined  from  an  empirical  relation¬ 
ship  for  tumbling,  low  fineness  ratio  cylinders 
coupled  with  data  at  0°  and  90°  angle-of-attack.  The 
location  and  ground  impact  velocity  of  the  segment(s) 
are  determined  from  the  3  DOF  simulation. 


All  trajectories  evaluated  for  the  supporting  analyses 
seen  in  Figure  1  lead  to  ground  impact  of  propellant 
as  fragments,  segments,  SRMUs  or  as  an  intact 
vehicle.  In  each  case,  it  is  necessary  to  determine 
the  behavior  of  the  propellant  in  terms  of  the  produc¬ 
tion  of  blast  waves  that  can  propagate  to  the  surround¬ 
ing  vulnerable  locations. 

Explosive  Yield  Correlation 

Because  SRMU  propellant  consists  primarily  of  am¬ 
monium  perchlorate  (AP),  powdered  aluminum  (Al) 
and  a  rubbery  binder  (FITPB  =  Hydroxy-Terminated- 
Poly-Butadiene)  it  is  considered  a  Class  1.3  propel¬ 
lant.  It  has  been  traditionally  assumed  not  to  be  det- 
onable  as  are  other  propellants,  such  as  Class  1.1, 
which  usually  contain  various  military  high  explo¬ 
sives.  Recently,  it  has  been  accepted  that  this  tradi¬ 
tional  view  is  only  partly  accurate  and  that  these 
materials  are  capable  of  explosive  reactions  up  to  and 
including  full  detonation  given  the  right  circurn- 


stances.  If  even  a  “partial”  or  “fading”  detonation 
occurs,  blast  waves  from  large  propellant  samples  are 
potentially  damaging.  What  was  needed  for  this  study 
was  a  quantitative  correlation  of  the  extent  of  the 
explosive  yield  given  an  impact  of  a  given  weight  of 
propellant  at  a  given  velocity  on  a  given  surface. 

Impact  Data 

Unfortunately,  there  is  only  a  relatively  small  body 
of  such  impact  data;  at  least  for  Class  1.3  propellant. 
While  two  sources  reported  scientific  findings 
(SANDIA  and  Lawrence  Livermore  National  Labo¬ 
ratory),  the  majority  and  most  relevant  data  in  terms 
of  the  weight  of  the  samples  are  contained  in  a  docu¬ 
ment  describing  “fallback”  events  of  failed,  live  mis¬ 
sile  firings  for  which  yields  were  roughly  estimated. 
Nevertheless,  the  data  were  transformed  to  a  com¬ 
mon  steel  impact  basis  using  standard  impedance- 
mismatch  calculations  using  the  shock-equation-of- 
state  (called  the  Hugoniot)  of  the  materials  involved. 
The  procedure  was  to  determine  the  shock  pressure 
in  the  propellant  in  the  actual  event  and  then  calcu¬ 
late  the  equivalent  steel  impact  velocity  that  would 
generate  the  same  shock  pressure  in  the  propellant. 
These  data  directly  represent  the  type  of  information 
needed,  but  the  lack  of  data  (22  points  total)  is  of 
concern  if  a  good  statistical  correlation  is  desired. 

Donor  Data  -  Impulse  Correlation 

There  are  a  number  of  Class  1.3  rocket  motors  (or 
propellants)  which  were  tested  by  “boostering”  with 
high  explosive  donors,  either  Class  1.1  rocket  mo¬ 
tors  or  military  high  explosives.  Boostering  in  these 
tests  means  that  a  donor  was  placed  on  or  near  the 
propellant  and  the  results  reported  as  yield  of  the  Class 
1.3  propellant  (the  acceptor)  for  the  given  geometry, 
shape,  weights  and  separation  from  the  donor.  These 
donor  data  were  converted  to  an  equivalent  steel  im¬ 
pact  velocity  by  equating  the  impulse  delivered  to 
the  acceptor  in  an  impact  event  with  that  delivered 
by  the  explosive  donor.  This  resulted  in  a  linear  ex¬ 
pression  relating  effective  steel  impact  velocity  to  the 
ratio  of  the  donor  weight  to  the  acceptor  weight  and 
several  fixed  parameters  which  correct  for  donor  com¬ 
position  and  geometry,  donor/acceptor  separation  and 
motion  of  acceptor.  Using  this  expression,  all  of  the 


donor  data  (31  points)  were  converted  to  equivalent 
impact  data. 

Correlation 

The  impact  and  donor  data  (53  points)  were  com¬ 
bined  and  correlated  to  obtain  the  desired  relation¬ 
ship  of  steel  impact  velocity  (V)  vs  propellant  weight 
(W)  vs  yield  (z),  defined  as  the  fraction  of  the  pro¬ 
pellant  weight  that  undergoes  detonation.  Because 
of  the  logarithmic  nature  of  the  physico-chemical 
processes  involved,  and  to  allow  statistical  treatment 
of  the  data,  100%  yield  points  (i.e.,  full  detonation) 
were  assigned  a  value  of  99%  and  0%  yield  points 
were  assigned  a  value  of  0.1%.  Further,  each  data 
point  was  assigned  a  weighting  factor  as  a  measure 
of  the  relative  reliability  of  the  data  based  on  the  origi¬ 
nal  test  reports. 

The  correlation  technique  adopted  (after  considering 
several  alternatives)  was  to  assume  that  the  quantity 
u,  one  minus  yield  over  yield  [(1  -  z)/z],  is  distrib¬ 
uted  lognormally;  i.e.,  follows  the  Gaussian  distri¬ 
bution  of  the  natural  logarithm  (In)  of  u.  This  makes 
sense  since  z  by  definition  varies  from  1  to  0,  u  var¬ 
ies  from  0  to  -°o  and  therefore  lnu  varies  from  -°o  to 
+oo,  which  is  appropriate  for  a  normal  distribution. 
Of  many  possible  alternatives,  it  was  found  that  the 
expression,  InV  =  A  +  BlnW  +  Clnu  +  DlnWlnu,  was 
the  “best”  correlation  function,  having  a  correlation 
coefficient  of  -85%.  Using  linear  regression,  the  con¬ 
stants  A,  B,  C  and  D  were  determined  from  the  com¬ 
piled  data. 

The  result  is  shown  in  Figure  8,  which  correlates 
impact  velocity  vs  propellant  weight  vs  yield  for  steel 
impact.  Because  of  the  nature  of  the  development  of 
the  correlation,  any  point  on  the  plot  represents  the 
median  of  a  distribution  function  of  yield,  normal  to 
the  z  direction;  this  distribution  is  not  shown  on  the 
plot,  only  the  midpoints.  This  simply  means  that  the 
same  weight  of  propellant  impacting  at  the  same  ve¬ 
locity  would  produce  a  series  of  statistically  varying 
yields  (not  the  same  one  every  time)  of  which  the 
given  point  is  the  median.  The  quantity  u  is  distrib¬ 
uted  lognormally.  The  “spread”  of  this  distribution, 
called  the  variance  factor  of  the  yield  distribution  (k) 
was  also  estimated  from  the  raw  data. 


W  -  Propellant  Weight  (lb) 


Figure  8.  Explosive  Yield  Correlation  (z5Q  -  50%  Probability  Curves) 

For  puiposes  of  standardization,  the  correlation  in  Figure  8  is  usable  for  all  ground  impacts  of  propel- 
Figure  8  is  based  on  shock  pressure  generated  by  steel  lant  weight  W  at  velocity  V.  Assuming  a  given  irn- 
impact.  This  does  not  match  the  varied  and  quite  pact  location,  the  surface  material  and  surface  factor 
different  surface  materials  actually  surrounding  the  S  are  identified.  From  this  modified  velocity  V/S, 
launch  site.  Three  surface  materials  were  shown  to  Figure  8  gives  the  median  yield  z  (usually  denoted 
closely  represent  all  these  surfaces:  concrete  in  the  Z50).  Therefore  the  median  propellant  weight  ex¬ 
vicinity  of  the  pad,  sand  in  the  surrounding  on-shore  ploded  is  Z5QW,  and  the  median  “TNT  equivalent’-  is 
land  and  water  in  the  surrounding  off-coast  areas.  1 .2z<q)W.  Here,  the  amount  exploded  is  converted 
Using  impedance  mismatch  calculations  based  on  the  to  a  standard,  the  amount  of  TNT  which  when  deto- 
respective  average  Hugoniots  of  these  materials,  the  nated  would  produce  the  same  blast;  1 .2  is  the  gener- 
impact  velocity  on  that  surface,  that  will  produce  the  ally  accepted  factor  for  Class  1.3  propellants.  The 
same  shock  pressure  in  the  propellant  as  would  a  blast  overpressure  produced  by  this  weight  of  TNT 
given  impact  velocity  on  steel,  was  calculated.  The  is  computed  for  a  given  range  from  the  impact  point 
ratio  of  the  impact  velocity  required  for  the  surface  with  a  well-known  set  of  equations  called  the 
of  interest  to  that  determined  for  steel  impact,  in  this  Kingery-Bulmash  relationships.  Of  course,  in  any 
way,  is  defined  as  the  surface  factor  (S).  For  each  of  given  case,  this  is  the  “median”  value  and  it  can  vary 
the  three  surfaces  it  was  found  that  S  only  varied  in  accord  with  the  previously  described  distribution 
slightly  over  the  entire  W  and  z  range  of  interest.  The  function, 
average  factors,  S  =  1.41  for  concrete,  S  =  1.81  for 
sand  and  S  =  2.92  for  water,  can  therefore  be  used  to 
effectively  transform  Figure  8  to  the  applicable  im¬ 
pact  surface. 


Probability  Assessment 

With  reference  to  Figure  1,  all  the  elements  of  the 
methodology  up  to  the  last  are  in  place.  It  is  now 
necessary  to  analyze  all  the  branches  of  the  event 
trees,  for  each  vulnerable  location,  to  “add  up,” 
probabilistically,  all  the  possible  events  and  all  the 
possible  consequences  to  determine  the  probability 
of  exceeding  a  given  level  of  blast  overpressure  vs 
blast  overpressure.  This  will  determine  the  overall 
risk  of  the  given  launch,  to  that  particular  location. 

Probability  Calculations 

For  all  failure  modes  which  lead  to  a  respective  event 
tree  at  a  given  failure  time  T,  the  “chain”  equation 
can  be  written  as  a  sum  of  product  teims.  The  first  is 
the  probability  of  the  failure  mode;  the  second  is  the 
probability  of  exceeding  a  given  (chosen)  blast  level 
at  T  given  the  failure  mode.  Since  the  failure  is  as¬ 
sumed  to  be  equally  likely  for  all  times,  the  chain 
equation  is  integrated  from  T  =  0  sec  to  Tmax  sec, 
defined  as  the  time  after  which  significant  blast  can¬ 
not  reach  any  vulnerable  location  (found  to  be  ap¬ 
proximately  25  seconds  after  launch). 

For  each  vulnerable  location,  repeat  calculations  for 
a  series  of  values  of  blast  overpressure,  produce  the 
general  result:  the  function,  probability  of  exceed¬ 
ing  blast  overpressure  vs  blast  overpressure. 

By  definition,  the  probability  of  a  failure  mode  is 
uniquely  related  to  the  complement  (one  minus)  of 
the  reliability  of  the  component/subsystem/system 
that  is  assumed  to  have  failed.  These  data  are  usu¬ 
ally  available  as  paid  of  the  system  specifications  and 
published  in  the  FMEA  document,  or  in  an  EIS  (En¬ 
vironmental  Impact  Statement)  or  as  an  engineering 
estimate.  Since  these  data  generally  refer  to  any  fail¬ 
ure  at  any  time  during  the  launch,  the  “book”  values 
cited  need  to  be  modified  for  our  puiposes  to  repre¬ 
sent  both  the  fraction  of  all  failures  of  the  compo¬ 
nent/subsystem/system  that  lead  to  the  specific  fail¬ 
ure  mode  we  are  considering,  and  those  failures  that 
could  occur  within  the  selected  time  increment  (or  at 
the  specified  event)  that  we  care  about;  e.g.,  failures 
after  Tmax  are  of  no  concern.  These  modifications 
represent  the  correction  factors  previously  cited. 


The  more  difficult  issue  is  to  determine,  for  each  fail¬ 
ure  mode,  the  probability  of  exceeding  the  chosen 
blast  level. 

This  is  accomplished  by  analysis  of  the  event  trees, 
which  arrange  failure  modes  systematically  stalling 
with  single  point  failures  and  developing  all  possible 
consequential  failures  including  probabilistic 
branches.  All  events  eventually  lead  to  one  of  the 
five  final  propellant  states.  As  previously  discussed, 
branch  probabilities  were  determined  based  on  engi¬ 
neering  judgement  or  analyses  considering  the  physi¬ 
cal  nature  of  the  event.  For  mechanical  failure  of 
attachments,  the  various  probabilities  of  various  paths 
(ground  impact  before  structural  failure  or  FTS  be¬ 
fore  ground  impact,  etc.)  were  found  to  change  sig¬ 
nificantly  with  the  timing  of  the  initial  failure. 

General  Procedure  for  Fragments:  For  each  fail¬ 
ure  time  there  are  six  impact  ellipse  areas  (each  con¬ 
sisting  of  five  ellipses)  which  correspond  to  the  six 
weight  bands  chosen.  Each  fragment  will  impact  in 
an  impact  ellipse  area  and  contribute  blast  overpres¬ 
sure  to  the  vulnerable  location.  The  ground  surround¬ 
ing  this  location  is  divided  into  a  suitable  matrix  of 
cell  areas  each  at  a  known  range.  For  a  chosen  blast 
overpressure,  we  index  through  each  cell  in  turn,  and 
determine  the  probability  of  a  fragment  landing  in 
the  cell  (see  Figure  7),  and  the  probability  of  exceed¬ 
ing  the  chosen  overpressure  from  its  impact  velocity 
and  location  (see  Figure  8  and  the  Kingery  &  Bulmash 
relationships).  The  product  of  these  is  the  probabil¬ 
ity  of  exceeding  the  overpressure  for  the  one  average 
weight  fragment  for  the  one  cell.  For  multiple  frag¬ 
ments  in  the  band,  this  result  is  modified  to  include 
the  sum  of  product  terms  of  the  probability  of  one 
(through  all)  fragments  landing  in  the  cell  and  the 
probability  that  these  multiple  impacts  will  cause  the 
overpressure  chosen.  This  result  is  then  obtained  for 
each  cell  and,  assuming  independent  events,  evalu¬ 
ated  for  Ml  cells  from  “one  minus  the  product  of  one 
minus  the  probability  for  each  cell.”  Next,  having 
up  to  six  weight  bands,  the  last  result  is  determined 
for  each  band  and  evaluated  for  all  bands  using  the 
same  product  rule  just  stated,  but  replacing  “cell”  with 
“weight  band.”  This  gives  the  final  result  for  frag¬ 
ments  of  the  “net”  probability  of  exceeding  the  cho¬ 
sen  oveipressure  at  the  vulnerable  location  for  the 
chosen  failure  mode  and  failure  time. 


General  Procedure  for  Segments,  SRMUs:  Large 
propellant  masses  are  treated  individually.  For  single 
or  paired  segments,  the  impact  velocity  and  location 
are  known  directly  from  the  3  DOF  code  since  they 
are  ballistic;  for  SRMUs  attached  to  the  core  or  the 
entire  vehicle,  these  values  are  known  from  the  6  DOF 
simulation  since  they  are  still  being  “guided.”  Vari¬ 
ability  in  impact  location  is  modeled  as  a  bivariate 
normal  distribution.  Knowing  the  weight  and  veloc¬ 
ity  at  impact,  the  yield  is  determined  from  the  yield 
correlation  (Figure  8).  A  “lethal  range”  (beyond 
which  the  chosen  overpressure  will  not  be  exceeded) 
is  then  defined  from  the  Kingery-Bulmash  relation¬ 
ships  noting  that  this  quantity  is  a  random  valuable 
because  yield  is  a  random  valuable  (see  discussion  of 
Explosive  Yield  Correlation).  The  probability  of 
exceeding  a  chosen  level  of  overpressure  at  a  given 
vulnerable  location  is  then  calculated  by  the  cover¬ 
age  function  (for  statistically  minded  readers,  a  non¬ 
central  chi  squared  distribution  with  2  DOF)  which 
integrates  the  bivariate  normal  distribution  over  an 
offset  circle  with  radius  equal  to  the  lethal  range,  cen¬ 
tered  at  the  vulnerable  location.  The  expected  value 
of  the  probability  of  exceeding  the  overpressure  is 
found  by  integrating  the  coverage  function  over  all 
values  of  lethal  range  up  to  the  maximum  value  de¬ 
fined  at  a  yield  of  100%. 

Given  an  event  tree  describing  one  failure  mode  at 
one  time,  a  generalized  sequence  of  calculations  is 
used  to  work  through  all  final  states  and  Ml  branches 
for  Ml  times  for  each  chosen  overpressure,  for  each 
vulnerable  location. 

The  probability  of  exceeding  the  overpressure  for  any 
final  state  is  the  product  of  the  branch  probabilities 
leading  to  that  state  and  the  probability  of  exceeding 
the  overpressure  given  that  branch  (these  are  the  num¬ 
bers  calculated  using  the  general  procedures  above). 
Calculations  are  repeated  for  every  final  state  at  ev¬ 
ery  time  and  the  results  integrated  over  the  time  of 
interest  to  give  the  average  or  expected  probability 
of  exceeding  the  overpressure.  This  is  repeated  for  a 
sequence  of  overpressures,  usually  0.1,  0.25,  0.5,  1, 
2,  4,  and  8  psi,  and  then  for  each  location. 

Since  all  failure  modes  can  affect  each  vulnerable 
location,  the  individual  results  are  combined  by  sum¬ 
ming  all  the  products  of  the  probability  of  the  failure 


mode  (as  discussed  earlier)  and  the  probability  of 
exceeding  the  overpressures  (the  function  just  de¬ 
scribed).  This  yields  the  final  result  of  the  probabil¬ 
ity  of  exceeding  the  overpressure  vs  overpressure  for 
all  failure  modes  at  the  location.  It  is  this  function 
that  is  to  be  used  by  the  Range  to  decide  how  safe  or 
how  risky  the  launch  is  for  that  vulnerable  location; 
i.e.,  is  this  (now  quantified)  risk  acceptable? 

Example  results  are  shown  in  Figures  9  and  10  for 
the  launch  site  and  one  other  location. 

CONCLUSIONS 

The  results  in  Figure  9  show  how  the  individual  fail¬ 
ure  modes  stack  up  to  yield  the  upper  line,  which  is 
the  overall  result  for  vulnerable  location  1,  the  launch 
site.  Note  that  the  vertical  scale  is  “logarithmic”  so 
that  each  major  division  is  a  factor  of  10  less  (or  more) 
than  the  next.  The  upper  failure  modes  therefore  con¬ 
tribute  most  heavily  to  the  overall  result.  For  this 
case  the  probabilities  do  not  diminish  significantly 
over  the  range  of  overpressures  considered.  The 
analysis  shows  that  a  large  explosive  yield  is  pos¬ 
sible  at  the  launch  site,  which  is  at  risk  for  consider¬ 
able  damage.  The  chance  of  these  overpressures  is 
about  one  in  a  thousand,  most  of  this  due  to  the  Tip- 
Over  case  (FM1  in  Figure  9)  discussed  above.  FIow- 
ever,  assuming  no  personnel  are  present  at  the  launch 
site,  this  may  still  be  acceptable  for  the  somewhat 
risky  business  of  launching  large  solid  rocket  mo¬ 
tors. 

A  different  result  is  seen  in  Figure  10,  which  shows  a 
rapid  drop  in  probability  with  overpressure  for  the 
individual  modes  and  the  total  in  the  upper  line;  the 
probability  of  exceeding  relatively  modest  blast)  is 
less  than  three  chances  in  a  hundred  thousand.  This 
is  an  example  of  much  safer  vulnerable  location. 

The  summary  results  for  ten  vulnerable  locations  are 
shown  in  Figure  1 1 .  Other  than  the  launch  site,  all 
the  locations  appeal-  safe  and  one  might  conclude  that, 
overall,  the  launch  risk  is  acceptable. 

One  important  feature  of  this  methodology  is  that  the 
results  can  be  used  not  only  to  assess  risk,  but  also  to 
mitigate  it  by  suggesting  ways  to  reduce  the  prob¬ 
ability  of  the  occurrence  (perhaps  a  minor  design 


Probability  of  Exceeding  Ap  Probability  of  Exceeding  Ap 


Figure  9.  Probability  of  Exceeding  Ap  for  Vulnerable  Location  1 
(Complex  41  -  Primary  Pad) 


Figure  10.  Probability  of  Exceeding  Ap  for  Vulnerable  Location  4 
(Complex  40  -  Secondary  Pad) 


Figure  11.  Probability  of  Exceeding  Ap  -  All  Vulnerable  Locations 


change  to  the  vehicle)  or  to  reduce  the  severity  of  an 
occurrence  (perhaps  by  changing  the  surface  proper¬ 
ties  of  the  ground  in  the  launch  pad  area  if  tip-over  is 
the  dominant  issue). 

In  summary,  the  methods  developed  in  this  study  have 
been  used  to  analyze  and  evaluate  the  hazards  asso¬ 
ciated  with  the  launching  of  a  very  complex  system. 
They  can  be  used  effectively  with  any  similar  ve¬ 
hicle,  including  much  smaller  and  simpler  ones,  and 
can  be  an  important  tool  for  evaluating  safety  at  any 
launch  range.  Since  almost  all  the  effort  required  is 
analytical  in  nature  and  the  method  uses  data  usually 
available  in  the  design  phase  of  the  system,  it  is  pos¬ 
sible  to  make  risk  determinations  in  a  timely  fash¬ 
ion;  the  payoff  to  Range  Safety  in  the  use  of  these 
methods  is  significant.  It  is  hoped  that  these  and  simi¬ 
lar  methods  are  adopted  by  the  aerospace  commu¬ 
nity  in  evaluating  the  safety  of  launch  systems. 
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